CAP Tested & Approved AppSec Practitioner Study Materials [Q10-Q27]

4/5 - (1 vote)

CAP Tested & Approved AppSec Practitioner Study Materials

Validate your Skills with Updated AppSec Practitioner Exam Questions & Answers and Test Engine

NEW QUESTION 10
To help review or design security controls, they can be classified by several criteria. One of these criteria is based on time. According to this criteria, which of the following controls are intended to prevent an incident from occurring?

Adaptive controls

Preventive controls

Detective controls

Corrective controls

NEW QUESTION 11
Which of the following roles is also known as the accreditor?

Chief Risk Officer

Data owner

Designated Approving Authority

Chief Information Officer

NEW QUESTION 12
Which of the following individuals makes the final accreditation decision?

ISSE

DAA

CRO

ISSO

NEW QUESTION 13
James work as an IT systems personnel in SoftTech Inc. He performs the following tasks:
Runs regular backups and routine tests of the validity of the backup data.
Performs data restoration from the backups whenever required.
Maintains the retained records in accordance with the established information classification
policy.
What is the role played by James in the organization?

Manager

Owner

Custodian

User

NEW QUESTION 14
You are the project manager of the NNH Project. In this project you have created a contingency response that the schedule performance index should be less than 0.93. The NHH Project has a budget at completion of $945,000 and is 45 percent complete though the project should be 49 percent complete. The project has spent $455,897 to reach the 45 percent complete milestone.
What is the project’s schedule performance index?

1.06

0.92

-$37,800

0.93

NEW QUESTION 15
You are the project manager of the GHY project for your organization. You are working with your project team to begin identifying risks for the project. As part of your preparation for identifying the risks within the project you will need eleven inputs for the process. Which one of the following is NOT an input to the risk identification process?

Cost management plan

Procurement management plan

Stakeholder register

Quality management plan

NEW QUESTION 16
Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency, or state of affairs?

Continuity of Operations Plan

Disaster recovery plan

Contingency plan

Business continuity plan

NEW QUESTION 17
What does RTM stand for?

Resource Testing Method

Replaced Traceability Matrix

Requirements Traceability Matrix

Resource Tracking Matrix

NEW QUESTION 18
There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events?

Acceptance

Mitigation

Sharing

Transference

NEW QUESTION 19
Which of the following administrative policy controls requires individuals or organizations to be engaged in good business practices relative to the organization’s industry?

Segregation of duties

Separation of duties

Need to Know

Due care

NEW QUESTION 20
You are the project manager of the GHY Project for your company. You have completed the risk response planning with your project team. You now need to update the WBS. Why would the project manager need to update the WBS after the risk response planning process? Choose the best answer.

Because of risks associated with work packages

Because of work that was omitted during the WBS creation

Because of risk responses that are now activities

Because of new work generated by the risk responses

NEW QUESTION 21
Mary is the project manager for the BLB project. She has instructed the project team to assemble, to review the risks. She has included the schedule management plan as an input for the quantitative risk analysis process. Why is the schedule management plan needed for quantitative risk analysis?

Mary will utilize the schedule controls and the nature of the schedule for the quantitative analysis of the schedule.

Mary will schedule when the identified risks are likely to happen and affect the project schedule.

Mary will utilize the schedule controls to determine how risks may be allowed to change the project schedule.

Mary will use the schedule management plan to schedule the risk identification meetings throughout the remaining project.

NEW QUESTION 22
You are preparing to complete the quantitative risk analysis process with your project team and several subject matter experts. You gather the necessary inputs including the project’s cost management plan. Why is it necessary to include the project’s cost management plan in the preparation for the quantitative risk analysis process?

The project’s cost management plan can help you to determine what the total cost of the project is allowed to be.

The project’s cost management plan provides direction on how costs may be changed due to identified risks.

The project’s cost management plan provides control that may help determine the structure for quantitative analysis of the budget.

The project’s cost management plan is not an input to the quantitative risk analysis process .

NEW QUESTION 23
Which of the following is correct?

The browser contains the private key of all known Certifying Authorities (CA) and based on that, it differentiates between a valid and an invalid TLS Certificate

The browser contains the public key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate

The browser contains both the public and private key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate

The browser does not have any mechanism to validate the TLS Certificate

NEW QUESTION 24
John is the project manager of the NHQ Project for his company. His project has 75 stakeholders, some of which are external to the organization. John needs to make certain that he communicates about risk in the most appropriate method for the external stakeholders. Which project management plan will be the best guide for John to communicate to the external stakeholders?

Risk Response Plan

Risk Management Plan

Project Management Plan

Communications Management Plan

NEW QUESTION 25
Mark is the project manager of the BFL project for his organization. He and the project team are creating a probability and impact matrix using RAG rating. There is some confusion and disagreement among the project team as to how a certain risk is important and priority for attention should be managed. Where can Mark determine the priority of a risk given its probability and impact?

Risk response plan

Project sponsor

Risk management plan

Look-up table

NEW QUESTION 26
Which of the following statements correctly describes DIACAP residual risk?

It is the remaining risk to the information system after risk palliation has occurred.

It is a process of security authorization.

It is the technical implementation of the security design.

It is used to validate the information system.

NEW QUESTION 27
In the context of the CORS (Cross-origin resource sharing) misconfiguration, which of the following statements is true?

CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access- Control-Allow-Credentials: true

CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access- Control-Allow-Credentials: false

CORS is exploitable if the value of the HTTP headers is Access-Control-Allow-Origin: * and the value of the Access-Control-Allow-Credentials header is irrelevant

All of the above

ISC2 CAP Exam Certification Details:

Exam Price	$599 (USD)
Duration	180 mins
Schedule Exam	Pearson VUE
Sample Questions	ISC2 CAP Sample Questions
Exam Name	ISC2 Certified Authorization Professional (CAP)
Exam Code	CAP